On Wed, Jul 17, 2019 at 01:35:01PM -0700, Zubin Mithra wrote:
> From: Paolo Bonzini <pbonzini@xxxxxxxxxx>
>
> commit 250715a6171a076748be8ab88b274e72f0cfb435 upstream.
>
> The syzkaller folks reported a NULL pointer dereference that seems
> to be cause by a race between KVM_CREATE_IRQCHIP and KVM_CREATE_PIT2.
> The former takes kvm->lock (except when registering the devices,
> which needs kvm->slots_lock); the latter takes kvm->slots_lock only.
> Change KVM_CREATE_PIT2 to follow the same model as KVM_CREATE_IRQCHIP.
>
> Testcase:
>
> #include <pthread.h>
> #include <linux/kvm.h>
> #include <fcntl.h>
> #include <sys/ioctl.h>
> #include <stdint.h>
> #include <string.h>
> #include <stdlib.h>
> #include <sys/syscall.h>
> #include <unistd.h>
>
> long r[23];
>
> void* thr1(void* arg)
> {
> struct kvm_pit_config pitcfg = { .flags = 4 };
> switch ((long)arg) {
> case 0: r[2] = open("/dev/kvm", O_RDONLY|O_ASYNC); break;
> case 1: r[3] = ioctl(r[2], KVM_CREATE_VM, 0); break;
> case 2: r[4] = ioctl(r[3], KVM_CREATE_IRQCHIP, 0); break;
> case 3: r[22] = ioctl(r[3], KVM_CREATE_PIT2, &pitcfg); break;
> }
> return 0;
> }
>
> int main(int argc, char **argv)
> {
> long i;
> pthread_t th[4];
>
> memset(r, -1, sizeof(r));
> for (i = 0; i < 4; i++) {
> pthread_create(&th[i], 0, thr, (void*)i);
> if (argc > 1 && rand()%2) usleep(rand()%1000);
> }
> usleep(20000);
> return 0;
> }
>
> Reported-by: Dmitry Vyukov <dvyukov@xxxxxxxxxx>
> Signed-off-by: Paolo Bonzini <pbonzini@xxxxxxxxxx>
> Signed-off-by: Radim Krčmář <rkrcmar@xxxxxxxxxx>
> Signed-off-by: Zubin Mithra <zsm@xxxxxxxxxx>
> ---
> Notes:
> * Syzkaller triggered a GPF in kvm_pic_clear_all with the following stacktrace
> when fuzzing a 4.4 kernel.
> Call Trace:
> [<ffffffff81270a07>] lock_acquire+0x294/0x2f3 kernel/locking/lockdep.c:3592
> [<ffffffff832bd6f7>] __raw_spin_lock include/linux/spinlock_api_smp.h:144 [inline]
> [<ffffffff832bd6f7>] _raw_spin_lock+0x2f/0x3e kernel/locking/spinlock.c:151
> [<ffffffff81084dce>] spin_lock include/linux/spinlock.h:302 [inline]
> [<ffffffff81084dce>] pic_lock arch/x86/kvm/i8259.c:45 [inline]
> [<ffffffff81084dce>] kvm_pic_clear_all+0x33/0x5b arch/x86/kvm/i8259.c:213
> [<ffffffff810968fb>] kvm_free_irq_source_id+0xc8/0xde arch/x86/kvm/irq_comm.c:197
> [<ffffffff810926bb>] kvm_create_pit+0x24e/0x5c5 arch/x86/kvm/i8254.c:713
> [<ffffffff8103aabf>] kvm_arch_vm_ioctl+0x592/0x17db arch/x86/kvm/x86.c:3858
> [<ffffffff81013cb4>] kvm_vm_ioctl+0xb7d/0xbfa arch/x86/kvm/../../../virt/kvm/kvm_main.c:2959
> [<ffffffff8149dc2e>] vfs_ioctl fs/ioctl.c:43 [inline]
> [<ffffffff8149dc2e>] do_vfs_ioctl+0xcb0/0xd0f fs/ioctl.c:630
> [<ffffffff8149dcfe>] SYSC_ioctl fs/ioctl.c:645 [inline]
> [<ffffffff8149dcfe>] SyS_ioctl+0x71/0xad fs/ioctl.c:636
> [<ffffffff832be2fa>] entry_SYSCALL_64_fastpath+0x31/0xb3
>
> * This patch resolves a conflict that arises in arch/x86/kvm/i8254.c:kvm_create_pit()
>
> * This commit is present in linux-4.9.y
>
> * Tests run: Chrome OS tryjobs, Syzkaller reproducer
Now queued up, thanks.
greg k-h
